Research & Evidence-Based Practice Flashcards

Based on Microsoft best practice research, what is the recommended AD DS forest design when an organization requires complete administrative isolation between two business units?

Answer: Separate forests for each business unit

Complete administrative isolation requires separate forests because forest-level boundaries are the only true security boundary in AD DS.

Microsoft's recommended evidence-based practice for placing domain controllers in a branch office with fewer than 25 users and limited WAN bandwidth involves which role?

Answer: Read-Only Domain Controller (RODC)

RODCs host a read-only copy of AD, preventing credential theft risks at insecure branch locations while still providing local authentication.

When researching the impact of enabling the Active Directory Recycle Bin in Windows Server 2008 R2, which prerequisite functional level must be met?

Answer: Windows Server 2008 R2 Forest Functional Level

The AD Recycle Bin requires Windows Server 2008 R2 Forest Functional Level, which means all DCs in all domains must run Windows Server 2008 R2 or later.

Research shows that bridgehead server failures cause entire site replication to stall. What is the evidence-based best practice to prevent a single point of failure?

Answer: Allow AD to use automatic bridgehead server selection rather than manually designating preferred bridgehead servers

Manual preferred bridgehead designation creates a single point of failure; automatic selection lets the ISTG elect multiple candidates and failover automatically.

Evidence from Microsoft guidance indicates that placing all five FSMO roles on a single domain controller is acceptable only under which condition?

Answer: In a single-domain forest with only one domain controller

In a single-DC environment all five FSMO roles must reside on that one DC; in multi-DC environments roles should be distributed according to best practice.

Research on AD DS security hardening indicates which practice reduces exposure when a domain controller is decommissioned improperly?

Answer: Run 'dcpromo /forceremoval' and then clean up metadata using ntdsutil

Force removal followed by metadata cleanup with ntdsutil removes all AD references to the decommissioned DC, preventing lingering objects and replication errors.

According to Windows Server 2008 best practice research, what is the recommended approach for AD sites and site links to ensure predictable replication costs?

Answer: Assign lower cost values to faster, more reliable WAN links so the KCC prefers them

Lower cost site links are preferred by the KCC when generating the replication topology, so faster links should receive lower costs to optimize replication paths.